CVE-2016-10140

7.5 highEPSS 6.6%

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 6.6% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2017-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zoneminder:zoneminder

References

http://seclists.org/bugtraq/2017/Feb/6
http://seclists.org/fulldisclosure/2017/Feb/11
http://www.securityfocus.com/bid/96849
https://github.com/ZoneMinder/ZoneMinder/commit/71898df7565ed2a51dfe76a1cf30ddb81fc888ba
https://github.com/ZoneMinder/ZoneMinder/pull/1697

Check your stack JSON